Skip to content

Commit 9b399be

Browse files
laruencelaruence
committed
Merge branch 'PHP-5.4' of git.php.net:php-src into PHP-5.4
2 parents e18e7a5 + 1f5b1cf commit 9b399be

File tree

15 files changed

+108
-8
lines changed

15 files changed

+108
-8
lines changed

‎NEWS

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ PHP NEWS
1010
. Fixed bug #65818 (Segfault with built-in webserver and chunked transfer
1111
encoding). (Felipe)
1212

13+
- Exif:
14+
. Fixed crash on unknown encoding. (Draal)
15+
1316
- FTP:
1417
. Fixed bug #65667 (ftp_nb_continue produces segfault). (Philip Hofstetter)
1518

@@ -22,7 +25,7 @@ PHP NEWS
2225
. Fixed bug #64230 (XMLReader does not suppress errors). (Mike)
2326

2427

25-
?? ??? 2013, PHP 5.4.21
28+
17 Oct 2013, PHP 5.4.21
2629

2730
- Core:
2831
. Fixed bug #65322 (compile time errors won't trigger auto loading). (Nikita)

‎ext/date/php_date.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1362,6 +1362,7 @@ PHPAPI signed long php_parse_date(char *string, signed long *now)
13621362

13631363
parsed_time = timelib_strtotime(string, strlen(string), &error, DATE_TIMEZONEDB, php_date_parse_tzfile_wrapper);
13641364
if (error->error_count) {
1365+
timelib_time_dtor(parsed_time);
13651366
timelib_error_container_dtor(error);
13661367
return -1;
13671368
}

‎ext/exif/exif.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2643,14 +2643,15 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
26432643
} else {
26442644
decode = ImageInfo->decode_unicode_le;
26452645
}
2646+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
26462647
if (zend_multibyte_encoding_converter(
26472648
(unsigned char**)pszInfoPtr,
26482649
&len,
26492650
(unsigned char*)szValuePtr,
26502651
ByteCount,
26512652
zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
26522653
zend_multibyte_fetch_encoding(decode TSRMLS_CC)
2653-
TSRMLS_CC) < 0) {
2654+
TSRMLS_CC) == (size_t)-1) {
26542655
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
26552656
}
26562657
return len;
@@ -2663,14 +2664,15 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
26632664
*pszEncoding = estrdup((const char*)szValuePtr);
26642665
szValuePtr = szValuePtr+8;
26652666
ByteCount -= 8;
2667+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
26662668
if (zend_multibyte_encoding_converter(
26672669
(unsigned char**)pszInfoPtr,
26682670
&len,
26692671
(unsigned char*)szValuePtr,
26702672
ByteCount,
26712673
zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
26722674
zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC)
2673-
TSRMLS_CC) < 0) {
2675+
TSRMLS_CC) == (size_t)-1) {
26742676
len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
26752677
}
26762678
return len;
@@ -2700,16 +2702,16 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
27002702
static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
27012703
{
27022704
xp_field->tag = tag;
2703-
2704-
/* Copy the comment */
2705+
2706+
/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX */
27052707
if (zend_multibyte_encoding_converter(
27062708
(unsigned char**)&xp_field->value,
27072709
&xp_field->size,
27082710
(unsigned char*)szValuePtr,
27092711
ByteCount,
27102712
zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
27112713
zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_unicode_be : ImageInfo->decode_unicode_le TSRMLS_CC)
2712-
TSRMLS_CC) < 0) {
2714+
TSRMLS_CC) == (size_t)-1) {
27132715
xp_field->size = exif_process_string_raw(&xp_field->value, szValuePtr, ByteCount);
27142716
}
27152717
return xp_field->size;

‎ext/exif/tests/bug62523_1.jpg

Lines changed: 9 additions & 0 deletions
Loading

‎ext/exif/tests/bug62523_1.phpt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_1.jpg")));
11+
?>
12+
Done
13+
--EXPECTF--
14+
Test
15+
16+
Warning: exif_read_data(bug62523_1.jpg): File not supported in %sbug62523_1.php on line %d
17+
int(1)
18+
Done

‎ext/exif/tests/bug62523_2.jpg

504 KB
Loading

‎ext/exif/tests/bug62523_2.phpt

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_2.jpg")));
11+
?>
12+
Done
13+
--EXPECT--
14+
Test
15+
int(76)
16+
Done

‎ext/exif/tests/bug62523_3.jpg

Lines changed: 12 additions & 0 deletions
Loading

‎ext/exif/tests/bug62523_3.phpt

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
--TEST--
2+
Bug 62523 (php crashes with segfault when exif_read_data called)
3+
--SKIPIF--
4+
<?php
5+
extension_loaded("exif") or die("skip need exif");
6+
?>
7+
--FILE--
8+
<?php
9+
echo "Test\n";
10+
var_dump(count(exif_read_data(__DIR__."/bug62523_3.jpg")));
11+
?>
12+
Done
13+
--EXPECTF--
14+
Test
15+
16+
Warning: exif_read_data(bug62523_3.jpg): File not supported in %sbug62523_3.php on line %d
17+
int(1)
18+
Done

‎ext/exif/tests/exif_encoding_crash.jpg

7.42 KB
Loading

‎ext/exif/tests/exif_encoding_crash.phpt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
PHP crash when zend_multibyte_encoding_converter returns (size_t)-1)
3+
--SKIPIF--
4+
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
5+
--FILE--
6+
<?php
7+
$infile = dirname(__FILE__).'/exif_encoding_crash.jpg';
8+
$exif_data = exif_read_data($infile);
9+
echo "*** no core dump ***\n";
10+
?>
11+
===DONE===
12+
--EXPECT--
13+
*** no core dump ***
14+
===DONE===

‎ext/intl/locale/locale_methods.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,9 @@ static char* getPreferredTag(char* gf_tag)
127127
int grOffset = 0;
128128

129129
grOffset = findOffset( LOC_GRANDFATHERED ,gf_tag);
130+
if(grOffset < 0) {
131+
return NULL;
132+
}
130133
if( grOffset < LOC_PREFERRED_GRANDFATHERED_LEN ){
131134
/* return preferred tag */
132135
result = estrdup( LOC_PREFERRED_GRANDFATHERED[grOffset] );

‎ext/pgsql/pgsql.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2639,7 +2639,7 @@ static void php_pgsql_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, long result_type,
26392639
Bucket *p;
26402640

26412641
fci.param_count = 0;
2642-
fci.params = safe_emalloc(sizeof(zval*), ht->nNumOfElements, 0);
2642+
fci.params = safe_emalloc(sizeof(zval***), ht->nNumOfElements, 0);
26432643
p = ht->pListHead;
26442644
while (p != NULL) {
26452645
fci.params[fci.param_count++] = (zval**)p->pData;

‎ext/standard/tests/file/disk_free_space_basic.phpt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
--TEST--
22
Test disk_free_space and its alias diskfreespace() functions : basic functionality
3+
--SKIPIF--
4+
<?php
5+
if (getenv("TRAVIS") === "true") die("skip inaccurate on TravisCI");
6+
?>
37
--INI--
48
memory_limit=32M
59
--FILE--

‎ext/zip/lib/zip_source_error.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
ZIP_EXTERN(void)
4141
zip_source_error(struct zip_source *src, int *ze, int *se)
4242
{
43-
int e[2];
43+
int e[2] = { 0, 0 };
4444

4545
if (src->src == NULL) {
4646
}

0 commit comments

Comments
 (0)